CVE-2026-85317

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85317

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85317.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85317

Published

2026-10-19T10:43:39Z

Modified

2026-10-21T03:00:30Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

Details

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token was obtained from. Two endpoints differing only in those fields therefore shared a cache entry, and an endpoint could be served a token minted for a different scope, a different resource, or by a different authorization server. The consequence is a request carrying broader authority than the endpoint was configured for, or a token presented to a party it was not issued for. Reaching it requires a deployment that configures more than one OAuth2 endpoint differing in exactly those fields, which is why the severity is assessed low.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The cache key now includes every field that shapes the token, so entries are no longer shared between endpoints that differ in any of them. For deployments that cannot upgrade immediately, run endpoints that differ in scope, resource indicator or token endpoint in separate JVMs so that they do not share the cache.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-524"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85317.json"
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

8d135894cd73970c82da5da0dc71ecc7f5521ad5

Fixed

2a16fcefbc5e4512a80180fae12c1f0f9ca0dff0

Introduced

3e9f3011ad48de66fef582ade9794c7340c23af7

Fixed

c056bef67cdfeffdc0ad7255e5e052cab71f2921

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.18.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.19.0"
                },
                {
                    "fixed":  "4.22.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85317.json"